# The access-list is always checked before NAT translation **URL:** \ **Category:** ASA\ **Created:** [December 12, 2018, 2:21pm UTC](https://forum.networklessons.com/t/the-access-list-is-always-checked-before-nat-translation/5699 "2018-12-12T14:21:06Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![sclarke1210](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/s/c6cbf5/32.png) [@sclarke1210](https://forum.networklessons.com/u/sclarke1210)\ **Post date:** [December 12, 2018, 2:21pm UTC](https://forum.networklessons.com/t/the-access-list-is-always-checked-before-nat-translation/5699/1 "2018-12-12T14:21:06Z")
Hi I’m really confused bt this statement “The access-list is always checked before NAT translation” So if I have traffic coming into the asa on the outside interface with a public IP address destined for a server on my dmz who has a private IP address translated by nat to the outside public address would I permit traffic destined from anywhere as an example to the private ip address of my server NOT the NAT public address? Thanks Simon ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [February 14, 2019, 7:19am UTC](https://forum.networklessons.com/t/the-access-list-is-always-checked-before-nat-translation/5699/2 "2019-02-14T07:19:51Z")
3 posts were merged into an existing topic: [Cisco ASA Access-List](https://forum.networklessons.com/t/cisco-asa-access-list/820) ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [February 14, 2019, 7:19am UTC](https://forum.networklessons.com/t/the-access-list-is-always-checked-before-nat-translation/5699/3 "2019-02-14T07:19:51Z")